PWI GUI Mapper

[krukovis]

dumbfck, tell me please more about the parameter "Control handler func". On PWI it equal 0x008C1C50 for button, but I use function adress 0x0086E650 for button command.

[dumbfck]

Originally Posted by krukovis

dumbfck, tell me please more about the parameter "Control handler func". On PWI it equal 0x008C1C50 for button, but I use function adress 0x0086E650 for button command.

If I remember correctly, I think I made this program before I better understood what this value is. I think the value that is displayed by the program is actually the first entry in the control / object's vTable (like a list of functions associated with that object).
I've talked a little about these tables and
Hope this helps.

[ntldr32]

Originally Posted by dumbfck

0xC1D758 is the correct static offset, but since you asked, here is the 'disconnect from server' window offset and how to find it. The static offset will definitely change when elementclient is updated. This offset chain has a better chance of remaining intact (although GUI stuff does sometimes change with bigger updates)

[[[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+0x798]+0x90]
(1 byte)

0x798 is the base for the window object, 0x90 is the flag that says if the dialogue is active.

Also you are correct that my GUI mapper didn't work for this. I need to look into why that is. (Although the GUI mapper does mostly work with updated base address... and child objects work if you replace all instances of 0x1C4 with 0x1C8).

But for easy future reference if for some reason this offset changes, here's how to find it.

Possibly the two most useful GUI system offsets are:

[[[[[baseCall]+0x1C]+0x18]+0x8]+0x254]
and
[[[[[baseCall]+0x1C]+0x18]+0x8]+0x258]

They show which GUI dialogue window you are hovering over and the child control of that object (respectively).
Load those offsets into Cheat Engine and then pull out your ethernet cable or otherwise disable your internet so the game disco's.
Now hover over the "Disconnected from server" window and write down the value in the first (0x254) offset.
In CE, add this address manually, then right click it and 'Find out what accesses this address'.
Just click on the first one (or any of them really) and click 'More information'.
It'll look something like this:



Look at the instruction above the red one (with the edi*4 in it) which is the one that references the dialogue object from the dialogue list - So just take the value of EDI and multiply it by 4.
In this case, that's 0x1E6 * 4 = 0x798
Then just take my word for it (or see some of my other GUI posts) that 0x90 is the flag that indicates if a dialogue is 'open'.
The list of dialogue objects is at (and has been for a long time)

[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]

So just add the window offset at the 'visible' flag and that gives us:

[[[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+0x798]+0x90]

Magic

corect me pliss
if the value in
[[[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+(object_offset*4)]+0x90]
=257 >>> windows object is open(apear/visible)
=0 >>> windows object is closed
its that right?
what do i use as flag for visible, 1 or 257?
or do i need to read 257 as byte?

[Shareen]

Unsigned byte has a range from 0 to 255.
Signed byte ranges from -128 to 127.

You can't read 257 as a byte.

[dumbfck]

Yep, what Shareen said.
257 = 0x101 in hex, so my guess is that you're probably reading a 4 byte value and actually getting 0x00000101.
You need to read it as a single byte - Then 1 = visible, 0 = not visible.
Or if you don't have a handy byte reading routine to hand, you could try a bitwise AND on it, e.g.,

var1 = 0x00000101
var2 = var1 & 0x000000FF

now var2 is 0x00000001

[ntldr32]

another question, i hope this is my last question to go expert XD lol.
i do some scan to get the gui base of Casting skill scrollbar that apear when we are zening (in BB, RB or doing vortex).
i get the offset for that casting skill scroll bar is 0x43 (vortexing).
but when i try to determine if it visible or not,
[[[[[baseCall]+0x1C]+0x18]+0x8]+0xC4]+0x43 * 4] + 0x90
the value that i got is far from 0 or 1 or even 257. its not even look like being a flag for that scroll bar.
do we need other method for scroll bar thing (casting skill scroll bar or whatever its name).

[dumbfck]

Are you on PWI?
I can see dialogues MagicProgress1, MagicProgress2 and MagicProgress3 at offsets 0x41*4, 0x42*4 and 0x43*4 respectively.
When I set up a BB, I see the flag at 0x90 of MagicProgress1 get set while the BB is setting up, then that goes to 0 and the MagicProgress3 0x90 flag turns on once the BB is fully established. Are you sure you're reading as a byte again?
If you read them at 4 byte words, they'll look like enormous numbers, for example, MagicProgress1 will be 0x3f000000 and MagicProgress3 will be 0xBF000000 (both while inactive).
Note that these dialogues can't be opened manually because they get closed instantly by the client.

[ntldr32]

ya im on PWI. and yes sorry, i read it as 4bytes again, sorry lol,
now it look goods,
now i can make my special autopot when my seeker are spining and disabled when it stop spin XD,..
thx